Google Chrome CVE-2026-84323

Exploitation requires two distinct prerequisites: (1) the attacker must have already achieved code execution within Chrome's renderer process via a separate, unrelated vulnerability - this is a significant and non-trivial precondition; (2) user interaction is required in the form of social engineering, meaning the victim must visit or interact with a crafted HTML page. Exploitation is limited to Chrome versions prior to 152.0.7977.75 on desktop platforms. The impact is confidentiality-only (no integrity or availability); the attacker can read sensitive FileSystem data but cannot modify or destroy it via this vector alone. Default Chrome installations are potentially affected if the renderer is compromised, but the renderer compromise itself limits realistic exploitation to targeted or chained attacks.

Real-world risk is materially lower than the C:H CVSS impact metric implies, due to the strict prerequisite of a pre-existing renderer compromise. The AC:H rating reflects this chained dependency accurately. An attacker who has already compromised the renderer has already cleared a significant exploitation bar - this vulnerability extends their reach into FileSystem data, but it does not itself provide initial access. EPSS data is absent from the provided intelligence; no KEV listing or public POC has been identified. The Chromium security severity is rated 'Medium' by Google, consistent with the two-stage exploitation requirement. The CVSS base score of 5.3 is appropriate. Given the renderer-compromise prerequisite and UI:R requirement, this is a meaningful but secondary exploitation primitive rather than a standalone critical vector. Organizations running unpatched Chrome in environments where renderer exploits are a plausible threat (e.g., high-value targets, known active campaigns against Chrome) should prioritize the update.

An attacker who has already exploited a separate renderer vulnerability to achieve code execution within Chrome's sandboxed renderer process crafts a malicious HTML page and uses social engineering to lure the target into loading it. The page invokes FileSystem API calls that lack proper browser-process authorization checks, allowing the renderer-level attacker to read sensitive filesystem data that should be inaccessible from the renderer context. No public POC has been identified at time of analysis.